Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 30
fleet/server/platform
History
Jordan Montgomery 076157c1a6
Add CSP to fleet(currently disabled - needs frontend work) (#41395) 
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #40538

This is the initial iteration of CSP functionality, currently gated
behind FLEET_SERVER_ENABLE_CSP. If disabled, no CSP is served. Nonces
are still injected into pages however a dummy nonce is used and has no
effect.

With this setting turned on things break and will be addressed by mainly
frontend changes in https://github.com/fleetdm/fleet/issues/41577

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
2026-03-12 18:06:54 -04:00
..
authz Activity bounded context: Complete read operations (#38555) 2026-02-09 15:29:12 -06:00
endpointer Add CSP to fleet(currently disabled - needs frontend work) (#41395) 2026-03-12 18:06:54 -04:00
errors Move PostJSONWithTimeout to platform/http package and activity cleanup (#40561) 2026-02-26 17:39:10 -06:00
http Fix data race in ErrorWithUUID.UUID() causing CI test failures (#40961) 2026-03-05 09:17:51 -06:00
logging Final slog migration PR: test infrastructure + tools + remaining standalone files (#40727) 2026-02-28 05:52:21 -06:00
middleware Fixed client-side errors being incorrectly reported as server errors in OTEL telemetry (#40051) 2026-02-19 16:06:00 -06:00
mysql slog migration: initLogger + serve.go + cron + schedule (#40699) 2026-02-27 14:29:27 -06:00
arch_test.go Move PostJSONWithTimeout to platform/http package and activity cleanup (#40561) 2026-02-26 17:39:10 -06:00
README.md Moved common_mysql package to server/platform/mysql (#38017) 2026-01-08 13:17:19 -06:00

README.md

Platform packages

This directory contains infrastructure and cross-cutting technical concerns that are independent of Fleet's business domain. These packages provide foundational capabilities used across the codebase.

Platform vs domain

Following separation of concerns, we distinguish:

  • Platform (infrastructure): Technical concerns like database connectivity, HTTP utilities, middleware, and transport-level error handling. These packages have no knowledge of Fleet's business domain.
  • Domain (business logic): Feature-specific code organized into bounded contexts. Domain packages depend on platform packages, not the reverse.

Guidelines

  • Platform packages must not import domain packages
  • Platform packages should be general-purpose and reusable
  • Architectural boundaries are enforced by arch_test.go